Add unit test to cover prepareSQL error case

Emyrk · Emyrk · commit f0bbaaf191e9 · 2023-02-10T12:14:36.000-06:00
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -369,7 +369,7 @@ func fetchWithPostFilter[
 func prepareSQLFilter(ctx context.Context, authorizer rbac.Authorizer, action rbac.Action, resourceType string) (rbac.PreparedAuthorized, error) {
 	act, ok := ActorFromContext(ctx)
 	if !ok {
-		return nil, xerrors.Errorf("no authorization actor in context")
+		return nil, NoActorError
 	}
 
 	return authorizer.Prepare(ctx, act, action, resourceType)
diff --git a/coderd/database/dbauthz/querier_test.go b/coderd/database/dbauthz/querier_test.go
@@ -214,6 +214,15 @@ func (s *MethodTestSuite) TestProvsionerJob() {
 		_ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{JobID: j.ID, WorkspaceID: w.ID})
 		check.Args(database.UpdateProvisionerJobWithCancelByIDParams{ID: j.ID}).Asserts(w, rbac.ActionUpdate).Returns()
 	}))
+	s.Run("BuildFalseCancel/UpdateProvisionerJobWithCancelByID", s.Subtest(func(db database.Store, check *expects) {
+		tpl := dbgen.Template(s.T(), db, database.Template{AllowUserCancelWorkspaceJobs: false})
+		w := dbgen.Workspace(s.T(), db, database.Workspace{TemplateID: tpl.ID})
+		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+			Type: database.ProvisionerJobTypeWorkspaceBuild,
+		})
+		_ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{JobID: j.ID, WorkspaceID: w.ID})
+		check.Args(database.UpdateProvisionerJobWithCancelByIDParams{ID: j.ID}).Asserts(w, rbac.ActionUpdate).Returns()
+	}))
 	s.Run("TemplateVersion/UpdateProvisionerJobWithCancelByID", s.Subtest(func(db database.Store, check *expects) {
 		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeTemplateVersionImport,
diff --git a/coderd/database/dbauthz/setup_test.go b/coderd/database/dbauthz/setup_test.go
@@ -11,8 +11,6 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/rbac/regosql"
-
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
@@ -23,6 +21,8 @@ import (
 	"github.com/coder/coder/coderd/database/dbauthz"
 	"github.com/coder/coder/coderd/database/dbfake"
 	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/coderd/rbac/regosql"
+	"github.com/coder/coder/coderd/util/slice"
 )
 
 var (
@@ -140,12 +140,21 @@ func (s *MethodTestSuite) Subtest(testCaseF func(db database.Store, check *expec
 
 		require.NotNil(t, callMethod, "method %q does not exist", methodName)
 
-		// Run tests that are only run if the method makes rbac assertions.
-		// These tests assert the error conditions of the method.
 		if len(testCase.assertions) > 0 {
 			// Only run these tests if we know the underlying call makes
 			// rbac assertions.
 			s.NotAuthorizedErrorTest(ctx, fakeAuthorizer, callMethod)
+		}
+
+		if len(testCase.assertions) > 0 ||
+			slice.Contains([]string{
+				"GetAuthorizedWorkspaces",
+				"GetAuthorizedTemplates",
+			}, methodName) {
+
+			// Some methods do no make rbac assertions because they use
+			// SQL. We still want to test that they return an error if the
+			// actor is not set.
 			s.NoActorErrorTest(callMethod)
 		}
 
diff --git a/coderd/database/dbgen/generator.go b/coderd/database/dbgen/generator.go
@@ -66,7 +66,7 @@ func Template(t testing.TB, db database.Store, seed database.Template) database.
 		UserACL:                      seed.UserACL,
 		GroupACL:                     seed.GroupACL,
 		DisplayName:                  takeFirst(seed.DisplayName, namesgenerator.GetRandomName(1)),
-		AllowUserCancelWorkspaceJobs: takeFirst(seed.AllowUserCancelWorkspaceJobs, true),
+		AllowUserCancelWorkspaceJobs: seed.AllowUserCancelWorkspaceJobs,
 	})
 	require.NoError(t, err, "insert template")
 	return template

Original file line number	Diff line number	Diff line change
`@@ -369,7 +369,7 @@ func fetchWithPostFilter[`
`369`	`369`	`func prepareSQLFilter(ctx context.Context, authorizer rbac.Authorizer, action rbac.Action, resourceType string) (rbac.PreparedAuthorized, error) {`
`370`	`370`	`act, ok := ActorFromContext(ctx)`
`371`	`371`	`if !ok {`
`372`		`- return nil, xerrors.Errorf("no authorization actor in context")`
	`372`	`+ return nil, NoActorError`
`373`	`373`	`}`
`374`	`374`
`375`	`375`	`return authorizer.Prepare(ctx, act, action, resourceType)`